diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/iproute2/files/iproute2-4.12.0-recursive-mount-netns.patch b/sdk_container/src/third_party/coreos-overlay/sys-apps/iproute2/files/iproute2-4.12.0-recursive-mount-netns.patch
new file mode 100644
index 0000000000..b8d6ff4ce7
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/iproute2/files/iproute2-4.12.0-recursive-mount-netns.patch
@@ -0,0 +1,32 @@
+From d6a4076b6ba6547d7e52c377a7c58c56eb5ea16e Mon Sep 17 00:00:00 2001
+From: Casey Callendrello <casey.callendrello@coreos.com>
+Date: Tue, 1 Aug 2017 17:46:09 +0200
+Subject: netns: make /var/run/netns bind-mount recursive
+
+When ip netns {add|delete} is first run, it bind-mounts /var/run/netns
+on top of itself, then marks it as shared. However, if there are already
+bind-mounts in the directory from other tools, these would not be
+propagated. Fix this by recursively bind-mounting.
+
+Signed-off-by: Casey Callendrello <casey.callendrello@coreos.com>
+Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
+---
+ ip/ipnetns.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ip/ipnetns.c b/ip/ipnetns.c
+index 198e9de..9ee1fe6 100644
+--- a/ip/ipnetns.c
++++ b/ip/ipnetns.c
+@@ -636,7 +636,7 @@ static int netns_add(int argc, char **argv)
+ 		}
+ 
+ 		/* Upgrade NETNS_RUN_DIR to a mount point */
+-		if (mount(NETNS_RUN_DIR, NETNS_RUN_DIR, "none", MS_BIND, NULL)) {
++		if (mount(NETNS_RUN_DIR, NETNS_RUN_DIR, "none", MS_BIND | MS_REC, NULL)) {
+ 			fprintf(stderr, "mount --bind %s %s failed: %s\n",
+ 				NETNS_RUN_DIR, NETNS_RUN_DIR, strerror(errno));
+ 			return -1;
+-- 
+cgit v1.1
+
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/iproute2/iproute2-4.12.0.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/iproute2/iproute2-4.12.0.ebuild
index 3443e720d9..4c37b16aac 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/iproute2/iproute2-4.12.0.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/iproute2/iproute2-4.12.0.ebuild
@@ -10,7 +10,7 @@ if [[ ${PV} == "9999" ]] ; then
 	inherit git-2
 else
 	SRC_URI="mirror://kernel/linux/utils/net/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+	KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
 fi
 
 DESCRIPTION="kernel routing and traffic control utilities"
@@ -42,6 +42,7 @@ DEPEND="
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
+	"${FILESDIR}"/${PN}-4.12.0-recursive-mount-netns.patch # rkt/rkt#3761
 )
 
 src_prepare() {
@@ -122,7 +123,7 @@ src_install() {
 		DESTDIR="${D}" \
 		LIBDIR="${EPREFIX}"/$(get_libdir) \
 		SBINDIR="${EPREFIX}"/sbin \
-		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		CONFDIR="${EPREFIX}"/usr/share/iproute2 \
 		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
 		MANDIR="${EPREFIX}"/usr/share/man \
 		ARPDDIR="${EPREFIX}"/var/lib/arpd \